feat: publication IA (magazine/brief/essay) + fixes critique

Publication IA:
- 4 templates (magazine, brief, essay, simple) avec CSS riche
- Rewrite IA (article/exercises/tutorial/reference/mixed)
- Modération avec timeout 12s + fallback safe
- Quotas publish_enhance par tier (basic=2, pro=15, business=100)
- Détection contenu stale (hash)
- Migration DB publishedContent/publishedTemplate/publishedSourceHash

Fixes:
- cheerio v1.2: Element -> AnyNode (domhandler), decodeEntities cast
- _isShared ajouté au type Note (champ virtuel serveur)
- callout colors PDF export: extraction fonction pure testable
- admin/published: guard note.userId null
- Cmd+S fonctionne en mode dialog (pas seulement fullPage)

i18n:
- 23 clés publish* traduites dans les 15 locales
- Extension Web Clipper: 13 locales mise à jour

Tests:
- callout-colors.test.ts (6 tests)
- note-visible-in-view.test.ts (5 tests)
- entitlements.test.ts + byok-entitlements.test.ts: mock usageLog + unstubAllEnvs
- 199/199 tests passent

Tracker: user-stories.md sync avec sprint-status.yaml

memento-note/lib/plan-entitlements.ts

@@ -18,6 +18,7 @@ export const FALLBACK_TIER_LIMITS: Record<
     suggest_charts: 5,
     ai_flashcard: 5,
     voice_transcribe: 20,
+    publish_enhance: 2,
   },
   PRO: {
     semantic_search: 200,
@@ -33,6 +34,7 @@ export const FALLBACK_TIER_LIMITS: Record<
     excalidraw_generate: 20,
     ai_flashcard: 100,
     voice_transcribe: 500,
+    publish_enhance: 15,
   },
   BUSINESS: {
     semantic_search: 1000,
@@ -48,6 +50,7 @@ export const FALLBACK_TIER_LIMITS: Record<
     excalidraw_generate: 100,
     ai_flashcard: 'unlimited',
     voice_transcribe: 'unlimited',
+    publish_enhance: 100,
   },
   ENTERPRISE: {
     semantic_search: 'unlimited',
@@ -63,6 +66,7 @@ export const FALLBACK_TIER_LIMITS: Record<
     excalidraw_generate: 'unlimited',
     ai_flashcard: 'unlimited',
     voice_transcribe: 'unlimited',
+    publish_enhance: 'unlimited',
   },
 };
 
@@ -100,6 +104,19 @@ function buildLimitMapFromRows(
   return map;
 }
 
+/** Merge DB entitlements with FALLBACK for features added after admin seeding. */
+function mergeWithFallback(map: LimitMap): LimitMap {
+  const fallback = fallbackToLimitMap();
+  for (const tier of Object.keys(fallback) as SubscriptionTier[]) {
+    for (const [feature, limit] of Object.entries(fallback[tier])) {
+      if (map[tier][feature] === undefined) {
+        map[tier][feature] = limit;
+      }
+    }
+  }
+  return map;
+}
+
 export function invalidateEntitlementCache(): void {
   cachedLimits = null;
   cacheExpiresAt = 0;
@@ -119,11 +136,11 @@ async function loadLimitMap(): Promise<LimitMap> {
     if (rows.length === 0) {
       cachedLimits = fallbackToLimitMap();
     } else {
-      cachedLimits = buildLimitMapFromRows(rows as Array<{
+      cachedLimits = mergeWithFallback(buildLimitMapFromRows(rows as Array<{
         tier: SubscriptionTier;
         feature: string;
         limitValue: number | null;
-      }>);
+      }>));
     }
   } catch (err) {
     console.error('[plan-entitlements] DB load failed, using fallback:', err);